An IPv6-only VPS has no public IPv4 address: it can only be reached on its IPv6 address, and it can only reach the internet over IPv6 itself. As IPv4 addresses have run out, more and more providers offer this cheaper option. Whether it pays off for you depends on what you want to run on the server and who connects to it. If you are new to IPv6, first read our blog post on what IPv6 is.

Why is an IPv4 address expensive?

The IPv4 address space is 32 bits, with about 4.3 billion addresses in total. RIPE NCC, which allocates the European addresses, handed out its last free block in November 2019. Since then new addresses are practically only available on the secondary market, where a single address costs tens of dollars. Providers build this cost into the price of a VPS, and since 2024 several large cloud providers have charged a separate hourly fee for every public IPv4 address.

The IPv6 address space is 128 bits and practically inexhaustible: a server often gets a whole /64 subnet, which is more than 18 quintillion addresses. An IPv6 address therefore costs the provider next to nothing.

Benefits

Lower price

If the provider does not have to supply an IPv4 address, the VPS can be cheaper: depending on the provider, the difference is typically between half a euro and a few euros a month. For a single server that is not much, but if you run many smaller machines (backend servers, workers, test environments), the savings add up.

Plenty of addresses, no address translation

If the provider gives you a whole IPv6 subnet, every container, virtual machine or service can have its own public address. There is no need for port forwarding or NAT, and two services can even run on the same port, on different addresses.

Less automated scanning

The whole IPv4 address space can be scanned in minutes, so the first SSH password guessing attempts show up on a new IPv4 server within a few minutes. The IPv6 address space is too large for blind scanning, so the logs are much quieter. This is not protection, though: the address can leak through the DNS AAAA record, the Certificate Transparency logs or the server’s outgoing connections. A firewall and secure SSH server settings are just as necessary on IPv6.

Future-proof

Mobile networks and many home internet providers already use IPv6, and according to Google’s measurements nearly half of users reach its services over IPv6. On an IPv6-only server you can learn now what will become the default later.

Disadvantages

Not directly reachable from IPv4-only networks

This is the biggest limitation. Many home and office networks, corporate networks, hotel and public Wi-Fi networks still use IPv4 only. Visitors coming from these cannot open your website or connect to your SSH, game server or API. For a web server a CDN solves this (see below), for other services it is harder.

IPv6 outbound too

The server cannot reach services that have an IPv4 address only. At the time of writing (November 2026), GitHub is one of them: github.com, api.github.com and the ghcr.io container registry are not reachable over IPv6, so git clone, releases downloaded from GitHub and installer scripts that rely on GitHub do not work. The same can happen with payment providers, third-party APIs, licence and update servers.

Most essential sources are reachable over IPv6, though: the Debian, Ubuntu and AlmaLinux package repositories, Docker Hub, PyPI, npm, WordPress.org and Let’s Encrypt. You can check whether a service has an IPv6 address with the dig command:

dig +short AAAA api.example.com

If the command prints nothing, the service is reachable over IPv4 only.

Not suitable as a standalone mail server

A standalone mail server, which receives mail directly from the internet and sends it there, should not run on an IPv6-only machine. Many mail servers still accept mail over IPv4 only, so you cannot send to them, and IPv4-only senders cannot send to you. On top of that, the large mail providers check mail arriving over IPv6 more strictly (they reject it without reverse DNS, SPF and DKIM).

In a distributed mail system, however, an IPv6-only VPS works well for storing mail. There, a frontend server with both an IPv4 and an IPv6 address (for example Exim and a Dovecot proxy) receives incoming mail and the IMAP, POP3 and SMTP connections of mail clients, then passes them on to one of several storage backends. The traffic between the frontend and the backends can go over IPv6: nobody needs to reach the backends from outside, so an IPv4 address would only be an unnecessary cost. The other option is an internal network (private VLAN) between the machines, if the provider offers one.

If you do not want to run your own mail system, leave your mail to a separate email hosting service. And if your application sends notifications over SMTP, check that the outgoing mail server is reachable over IPv6.

Your own network needs IPv6 too

To connect to the server over SSH, your own internet connection must have IPv6 as well. You can check it on your own computer with:

curl -6 https://ifconfig.co

If the command returns an error instead of your IPv6 address, your network is IPv4-only. In that case you can reach the server through an intermediate server with both an IPv4 and an IPv6 address (a jump host), over a VPN, with Cloudflare Tunnel and Access, or through the provider’s web console.

Software that assumes IPv4

Some programs listen on the IPv4 address (0.0.0.0) only by default, or have an IPv4 address in their settings. Docker containers get an IPv4 address only by default, so on an IPv6-only machine IPv6 support has to be enabled separately in the daemon.json file, otherwise the containers cannot reach the internet. Some third-party monitoring and uptime services also check from IPv4 only.

For a web server: put a CDN in front of it

For a website, the problem of IPv4-only visitors can be solved with a CDN. The CDN accepts visitors over both IPv4 and IPv6, and connects to your server over IPv6. Cloudflare’s free plan works this way too:

1. Add the domain to Cloudflare and create an AAAA record with the IPv6 address of the VPS, with the proxy turned on (orange cloud). No A record is needed.
2. The server needs a valid SSL certificate, and Cloudflare has to be set to Full (strict) mode; the article SSL behind Cloudflare explains the difference between the modes.
3. Set up the web server to log the visitor’s real IP address instead of Cloudflare’s: in Nginx this takes real_ip_header CF-Connecting-IP; and set_real_ip_from lines for the Cloudflare IP ranges, in Apache the mod_remoteip module. The list of ranges is on the https://www.cloudflare.com/ips/ page.
4. If you like, allow ports 80 and 443 in the firewall from the Cloudflare IPv6 ranges only, so nobody can reach the server by bypassing the CDN.

With other CDNs, first check whether they can connect to an IPv6-only server (origin), as not all of them can.

This solution has its limits too: Cloudflare’s free proxy only forwards HTTP and HTTPS traffic, not the traffic of SSH, mail, a database or a game server. For these, Cloudflare Tunnel can be a solution: cloudflared, running on the server, opens the connection to Cloudflare itself, so it does not even need an open port. On an IPv6-only machine start it with the --edge-ip-version auto (or 6) option, as by default it tries to connect over IPv4.

If you have several IPv6-only servers, another option is a small VPS that also has an IPv4 address and forwards the traffic to the other machines as a reverse proxy, for example with Nginx Proxy Manager.

Outbound traffic: NAT64 and DNS64

If the server also needs to reach IPv4-only services, NAT64 and DNS64 help. A DNS64 resolver returns an IPv6 address for names that have an IPv4 address only (with the 64:ff9b::/96 prefix), and the NAT64 gateway translates this traffic to IPv4. If your provider offers NAT64, all you need is to set the DNS64 server as the server’s DNS resolver.

There are free public NAT64 services too, but they are run by volunteers, promise no availability, and your traffic passes through a third party, so we do not recommend them for production systems. It is more reliable to send the traffic through a server of your own that also has an IPv4 address, for example with an HTTP proxy or an SSH SOCKS proxy.

When is it a good choice?

Usage	IPv6-only VPS?
Website or web application behind Cloudflare or another CDN	Yes
Backend, database or worker reached only by your own servers	Yes, if those are on IPv6 too, or a proxy sits in front of them
Test server, learning, experimenting	Yes
Standalone mail server	No
Mail storage backend behind an IPv4 frontend (Exim, Dovecot proxy)	Yes
Game server, VPN, VoIP that users connect to directly	Only if every user has IPv6
Deployment or CI/CD that relies on GitHub	Only with NAT64 or a proxy
Application that calls third-party APIs or payment systems	Check first that they are reachable over IPv6

In short: an IPv6-only VPS pays off when a CDN or a proxy makes the server’s services available to the IPv4 world, and the server only uses outbound sources that are also reachable over IPv6. If in doubt, a server that also has an IPv4 address brings fewer surprises.

IPv4 and IPv6 on aWh VPSs

On our KVM VPS plans every server gets both an IPv4 and an IPv6 address by default, so it is reachable over both protocols and reaches the internet over both. If you do not need an IPv4 address, you can choose at the time of ordering to run the VPS with an IPv6 address only, which makes it cheaper. For a website behind Cloudflare or the internal machines of a distributed system the IPv6-only option is enough; for the frontend server and any machine that has to be reachable directly over IPv4, choose the one with an IPv4 address as well. Setting up the IPv6 address is covered in a separate article.